Plenty of integrations gate access by source IP. A bank's API, a partner's firewall, an on-prem database behind a corporate perimeter — they all want a fixed address to put on an allowlist. The problem: when traffic leaves through a shared, multi-tenant platform, the outbound IP isn't yours alone and isn't guaranteed to stay the same. A static egress IP is the usual fix. This post explains what one is, how it differs from a dedicated ingress IP, and where Ngris stands on both today.
The allowlist problem
"Outbound" here means traffic a platform sends to your backends and partner systems on your behalf. If that traffic can come from any IP in a shared pool, the only safe allowlist a partner can write is a broad one — which defeats the point. You want a single, predictable address so the partner can allow exactly that and nothing else.
What a static egress IP is
A static egress IP gives outbound traffic a fixed source address. You hand that one IP to the partner or drop it into the firewall rule, and it doesn't drift.
Ngris does not offer static egress IPs today — there is no egress setting on endpoints and no egress add-on, dedicated or shared. For a tunnel you usually don't need one: requests your service makes to a partner leave from your own network, not through Ngris, so the partner allowlists your network's address as it would anyway. The security docs cover the details.
Egress is not the same as a dedicated ingress IP
This is the part that trips people up, so it's worth being precise. Egress and ingress are opposite directions:
Static egress IP (outbound)
The address your traffic leaves from. Use it so a partner or firewall can allowlist a single source IP for the requests a platform makes on your behalf.
Dedicated IP (inbound)
A stable, exclusive address your endpoint is reached at. Published as a plain DNS A record (single region) or a CNAME to a per-region GeoDNS group. Useful when an upstream needs to allowlist where it connects to.
If you need a fixed inbound address, that's a dedicated ingress IP. Ngris has one built — a single-region A record or a per-region GeoDNS group, up to 6 IPs per account — but the add-on isn't available for purchase at the moment. See the Dedicated IPs docs. Reach for static egress when the requirement is "your traffic must come from this IP," and a dedicated ingress IP when it's "we must connect to this IP."
When you'd reach for static egress
- Partner APIs that allowlist callers by source IP.
- Corporate firewalls in front of an on-prem service you're integrating with.
- Databases and internal systems reachable only from approved addresses.
Current plans and add-ons are on the pricing page.
Expose a service without opening your firewall
The Ngris agent connects out to the edge, so nothing inbound is opened on your network.
Create a free account →